Senior Security Engineer

About the role

• Diagnoses and refines successful and failed detections, alerts and security logs, including network and endpoint alerts, to ensure security logging and monitoring coverage meets the needs of CFC's business objectives and its technology and threat environments.
• Leads incident response operations and continuous improvement from investigation through containment and recovery, publishes incident reports with revised playbooks.
• Designs and operates threat assessment services, including threat profiling and modelling and attack simulation, and records attack paths, threat intelligence and new requirements arising from assessments.
• Diagnoses complex chains of vulnerabilities or misconfigurations in software, application security tests, the build pipeline, malware defences, email and web protection, secure configuration or network infrastructure to root cause, and designs and implements controls to prevent recurrence.
• Produces expert guidance on the security design for a system and leads the security aspects of definitions of ready and done in projects.
• Diagnoses systemic contributing factors in conditional access, privileged access, device verification or the identity lifecycle failures, and implements the controls to prevent recurrence.
• Classifies sensitive data sets that have or will fail control coverage or effectiveness testing and implements the data protection controls to prevent recurrence, covering data loss prevention, encryption, privacy requests, insider detection and disposal.
• Evaluates control assurance, audit and continuous controls monitoring findings against the asset inventory, traces gaps, and updates standards and monitoring to prevent recurrence.
• Builds integration templates, self-serve, deterministic and non-deterministic workflow automations and analytics for repeated security tasks and coaches teams on runbooks.
• Leads incident exercises, runs tabletops against the continuity plan, and coaches CFC colleagues through awareness training and behavioural nudges.
• Experience building and maturing security standards, workflows, guidance and operational controls.

About you

• Proven experience in a technical security role, including security operations, threat detection and response, security engineering, cloud security, or application security within a fast-paced regulated organisation.
• Strong knowledge of CI/CD, cloud-native architecture, Infrastructure as Code and software supply-chain security.
• Experience leading threat modelling and resolving complex security and privacy design trade-offs.
• Ability to assess and deploy emerging data protection, AI and agentic engineering practices pragmatically and establish proportionate controls.
• Ability to influence senior technical and non-technical stakeholders through evidence, technical credibility and a pragmatic appreciation of both rigour and speed.
• Practice guiding engineers who are earlier in their career in the same domain, and coaching people through an exercise or a training session.
• Keen security mindset with excellent analytical and problem-solving skills, capable of assessing complex risks, identifying root causes, and delivering practical, threat and risk-informed solutions.

Core Values